Overview

overview

8

Static

static

3

2026-07-12...r_.exe

windows10-2004-x64

8

2026-07-12...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    12/07/2026, 13:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-12_4b1969ff2373931786c1b26c944c64ba_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 37.3MB
  • Sample260712-qmnlfacw71
  • SHA256 b97a62bf25f7bb5de6f6698372ef1b869245da494ba262bbf0f27230d6f1979c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-12_4b1969ff2373931786c1b26c944c64ba_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-12_4b1969ff2373931786c1b26c944c64ba_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1404
  • C:\Users\Admin\AppData\Local\Temp\2026-07-12_4b1969ff2373931786c1b26c944c64ba_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-12_4b1969ff2373931786c1b26c944c64ba_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5788

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 37.6MB
        • SHA256 f97b7341e841a512a77ace8dc235102e1b438902da57858fbe2bef35cd7c48bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 39.4MB
        • SHA256 529f419d72dc23cd7a0380891943d0a881681368fb49457818ca4b5eeda5e8ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 43.4MB
        • SHA256 a6a574a0adc1f5366936d8eec1566f1aea5e5983dc519d9105c4fc2aa9554d7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 76.3MB
        • SHA256 d02ba7ba04e8b4d30767223265de19e6170935d3c4f4d6d982424b68fdc281c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 71.6MB
        • SHA256 9dc4b116e861c6f887f9b6d8ce8cfc7b654775f5634c2ca0e33b1b57789b2914
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 69.0MB
        • SHA256 d64acb09768f02604ea128de08b2469731db1bfe96f5e44e3714b8e1a0e1e8fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 66.0MB
        • SHA256 a1b1cce090306308847a9de47d8045ba099b18985481b346cf1f73cc033a2618
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 57.6MB
        • SHA256 cffc897f9dcade5c2cbf72749ba9a55de99272989a8071a7abdec63f1b5ef343
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 55.8MB
        • SHA256 4eee006c15032938d7e632d72b820afce0663ed25ce598544cf899c734f49d20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 55.9MB
        • SHA256 cae419894be373883ce3723a247b9ca8958497ac97fdf035ce448c2838854168
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 53.4MB
        • SHA256 7e1654e4344f60f1c288ac196135bf35fe56260771483cf329b78a964a1e494a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 51.5MB
        • SHA256 325ed1a97d8b24f4f671e422c7c1e2f479003871a5575029d7ac63aaa19996c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 48.2MB
        • SHA256 48c7c60228b1018fec1e33d7c5c46687a7e067322452411b057d26b7f8e3c443
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 49.2MB
        • SHA256 cbb4ed2ee9ecef5d3382caa871902b63ffab30f38abb96088aca1f1defb38796
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 47.9MB
        • SHA256 15a145d832744acd05e260dbb11e1217b09afa20f868ab789b4b0df57dab692c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 47.4MB
        • SHA256 b3ab12ceb5abb03da3ad2ffef28e93641620a904603b67237d719f9903eec883
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 47.3MB
        • SHA256 f66cf3ab7893152aeae7dc2c8285bfc8ca695ab505d1d105027544237b4d3452
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 44.9MB
        • SHA256 a242c6140b84dceb0a82cc99642f114fe288fd964d2dc2bee065abcb3f971f72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 43.0MB
        • SHA256 7b23aece6694e4455a28f9e65faf031b34bc51c146ab017f41ce6e3171e5a1fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 42.2MB
        • SHA256 b69e76164095941fab01942b8b4cbf38282d04bebb6be53720950cb2bc1ba7c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 41.6MB
        • SHA256 d2dae5394cf7240acdce267e36981e989a40923ae72b63ce76880c79207f32ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 40.9MB
        • SHA256 564488097bfce666227e3d9f458ecdd46af1173a3b0a88efe814cf889334db55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 39.9MB
        • SHA256 0bb88360236d4a476a95eaffaff7a6a217be22b58f156a235ebfb5d686c2e370
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 37.6MB
        • SHA256 4546f335ddad6b8e3409efedce8d53523192f8bb74e52ebf2736fcc68857446c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 37.1MB
        • SHA256 5b71e37eaf4b59b8185b9b9b408edb9c0a70e998616ec0939382d4ff43133aa9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 37.1MB
        • SHA256 fb8311225213d839ddfd6adc9a6c8cb0d88696a20568744d4f272f22eb3d899f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 33.3MB
        • SHA256 66a636c77f44557bfd531d6b49c5f5d9fcf146bca2c74969b952a5193d380ee7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 33.2MB
        • SHA256 d883d68a6321fc74dfe4d61fd99f771beddfe2984275610d6f70ff5b95678c7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 33.9MB
        • SHA256 5713389b2bff12babbe7e77bff3bad2be82a93628eee564eea9421260a223e97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 13.7MB
        • SHA256 9be320b108f9d825556e4e51e186371a3174e14d493f12b3b63b02fd7a571974
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 15.9MB
        • SHA256 a31d8c7d4d8a714282ea382fc9e01f7f4246557e51e30fb1e6dce356daa2b4e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 15.4MB
        • SHA256 47b9f9d125c36dac9dc4751882f634c92ed08e5fbb044b86c660c8bb5fe88359
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 13.2MB
        • SHA256 a66a0920dd7d19a92f57587948dc0ce3ae57ef9aaf110f7f540ef57881c5a099
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 15.2MB
        • SHA256 e32e00985bc1f26609096e81898bbcb5bfd8179d1a1e7e55b1ab276a54ba68ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 14.4MB
        • SHA256 94b697f52d6bfb1be9b6c84836d2da2c9a290fdfc0c3822b75266d61e71d7a85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 13.1MB
        • SHA256 05710cd4a2bc603b4d35ac73b60b032844f157e8308d2b4e320e5b8d2846e166
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 12.4MB
        • SHA256 e37a5a52db696d4341114d2a1afbc16a1d4532498fc397c486ca4c82e06a951d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 12.7MB
        • SHA256 a8a1e36b7c21d144003dbee8c5940eb215f283e5fbf5508b681681dd7efbafab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 12.8MB
        • SHA256 71328ebd5af9f6ba8fcd2a7d0837e82e58edc4ec5318462456ecbd115c80c0b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 12.7MB
        • SHA256 58744d618d79559caa06a7d6d6c87c22c7b5c7efc036c0b1b2edbd8187cc75a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 12.5MB
        • SHA256 b5b97c1cfeee70a1d5520e5fe011631b507fccf974c3b9dbcc1421f9dd0de30f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 12.4MB
        • SHA256 349e6e5fe93cc292e6408c9259e3230d82b9aab720af2760549acd923fd5080b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 12.1MB
        • SHA256 24942fff3c7218c6e17a3bc78e781994014a87c50f7d9e26d1d7c8df365eabb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 11.5MB
        • SHA256 0f8fcb4a9368a6a96c2218c7b2a2d9b0b20cc2841928f1cff9b929ec187d9051
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 9.5MB
        • SHA256 7ae065562ef30bf1897734ba7dad0ed0f153e502c764bf8be9ee963e40b0955e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
        • Size 9.8MB
        • SHA256 8498fc211d11200dfd012ffe178d0d09532d0dca11bccc6c4417fd13de552274
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
        • Size 11.0MB
        • SHA256 0fc02367ca2448ccd7b210e50cd8cbaa10222f466ed0a94cdb2d7351523c8973
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
        • Size 10.2MB
        • SHA256 81e00f71025b778b1711ff2050b878f33bcd7d375507a386e2939793df01e075
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
        • Size 10.2MB
        • SHA256 2a8fd06d4e00a0337037095c5c50eb1420dc9aab469cda0b3047ebcfc4bb8aed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download